kleb/kBackup
Watch
1
0
Fork
You've already forked kBackup
 0
Code Issues Pull requests Projects Releases 4 Packages Wiki Activity Actions
4 releases 4 tags
  • v1.1.0 3364bbb5ef

    kBackup v1.1.0 Stable

    kleb released this 2026-07-27 16:04:22 +02:00 | 54 commits to main since this release

    kBackup v1.1.0

    This is the production-signed v1.1.0 release. The exact tagged source is
    3364bbb5eff23ed75c4e55c078606c7f7cf11b26.

    Changelog

    • Added TUI controls for enabling and configuring the web interface.
    • Added a simple first-run web setup flow launched from a one-time owner URL
      generated by the TUI.
    • Preserved owner token authentication after initial setup.
    • Added web configuration persistence, validation, and service integration.
    • Added coverage for web settings, setup tokens, authentication, and setup-page
      behavior.
    • Updated the Web UI and generated protobuf clients.
    • Removed generated web/dist files from Git; release builds now rebuild and
      verify the embedded UI before compiling with the webdist build tag.
    • Expanded build-artifact and frontend-cache exclusions in .gitignore.
    • Removed the hosted CI workflow because this repository does not use hosted
      CI.

    Signing And Trust

    kBackup uses self-managed release trust rather than a commercial public
    code-signing certificate. Authenticate this exact trust-manifest SHA-256
    through an independent channel before installing the bundled root:

    405fbb57e597845d2d0f85855bd8df9f5cfad82ec3e54fbdb11cc010fa9dd020

    Approved production identities:

    • Authenticode signer certificate SHA-256:
      8edce320469b986ac0ee934bd84b06c98612f6f7e0a8ce228c9a9718ae4960fe
    • RFC 3161 timestamp certificate SHA-256:
      2a19aedf8fa8f61e5851562c354e7d27d0029ad3292510aba8051801675bb3d0
    • OpenPGP signing subkey:
      D1ED1F306D446FB0F7A3C0BD2B3AA6B27E33386A
    • Cosign public key SHA-256:
      2cb49a5331a5d0fb14347469bf2f4063969069f462d52e3b6ea75451462e5a3d

    The complete public bundle is attached as
    kbackup-v1.1.0-public-trust.zip. Private signing material is not included.

    Verification

    Start with BUNDLES-SHA256SUMS, then use the platform archive for complete
    SBOM, provenance, checksum, and Sigstore material:

    sha256sum -c BUNDLES-SHA256SUMS
cosign verify-blob --key v1/cosign/cosign.pub \
  --bundle SHA256SUMS.linux-amd64.sigstore.json \
  SHA256SUMS.linux-amd64

    The DEB and RPM carry native OpenPGP package signatures. The Windows CLI,
    daemon, and installer carry SHA-256 Authenticode signatures and critical
    RFC 3161 timestamps. Windows reports them as trusted only after the
    self-managed root and publisher certificates are deliberately enrolled.

    Key convenience-download SHA-256 values:

    kbackup-setup-v1.1.0-x64.exe
d3910dc4b04734965738b52836356c59db919d6c5f3254afe20c5c95e0c5de07

kbackup_1.1.0_amd64.deb
fe3ad8f1784af50edd580f49baf18a971151faf9e9af2544a1b3b48e8b4a1036

kbackup-1.1.0-1.x86_64.rpm
29bec5afb09209a9e61dacb9f93f4c482733feab5ccbbb8ad30ba904526d6560

    The exact signed artifacts passed clean disposable-VM acceptance on Windows
    11 Enterprise 25H2/NTFS first, followed by Debian 13/ext4. Acceptance covered
    signature trust, install and service lifecycle, backup and content-verified
    restore, retention, check/scrub/prune, reboot credential reopen, owner web
    setup link and web load, uninstall data retention, and reinstall/reopen.

    The supported platform and repository boundaries remain those documented in
    docs/support.md.

    Downloads